Hi all! I am excited to announce the release of my toy project called ‘Noir’ 🎉🚀

Noir is a source code analysis tool that identifies API endpoints, methods, parameters, and more within the source code, providing various formats of output. Today, I’ll give you a brief description of this tool.

Installation

Currently, installations are available through Homebrew and source code-based installations. Please refer to the following commands.

Homebrew

brew tap hahwul/noir
brew install noir

From Source

# Install Crystal-lang
# https://crystal-lang.org/install/

# Clone this repo
git clone https://github.com/hahwul/noir
cd noir

# Install Dependencies
shards install

# Build
shards build --release --no-debug

# Copy binary
cp ./bin/noir /usr/bin/

Basic

The ‘Basic’ related flags refer to essential flags for analysis. You can set the base directory, URL, and scope for the analysis.

  Basic:
    -b PATH, --base-path ./app       (Required) Set base path
    -u URL, --url http://..          Set base url for endpoints
    -s SCOPE, --scope url,param      Set scope for detection

The ‘-b’ flag is required, and it specifies the base directory for analysis. By using the ‘-b’ option, you can analyze the source code directory. By default, it analyzes the technologies used within that directory and operates the engine associated with each technology to perform the source code analysis.

noir -b <BASE-PATH>

Output Formats

The ‘Output’ related flags allow you to configure options for formatting and logging related to the output.

  Output:
    -f FORMAT, --format json         Set output format [plain/json/markdown-table/curl/httpie]
    -o PATH, --output out.txt        Write result to file
    --set-pvalue VALUE               Specifies the value of the identified parameter
    --no-color                       Disable color output
    --no-log                         Displaying only the results

# Plain
noir -b . -u http://localhost:3000

# Curl
noir -b . -u http://localhost:3000 -f curl

# HTTPie
noir -b . -u http://localhost:3000 -f httpie

# JSON
noir -b . -u http://localhost:3000 -f json

# Markdown table
noir -b . -u http://localhost:3000 -f markdown-table 

Example - Curl Format

Delivers

Through the ‘Delivers’ subflags, you can establish interactions with other tools.

  Deliver:
    --send-req                       Send the results to the web request
    --send-proxy http://proxy..      Send the results to the web request via http proxy

Noir to ZAP

Support Targets

Language	Framework	Tech Detect	URL	Method	Param	Header
Go	Echo	✅	✅	✅	X	X
Python	Django	✅	✅	X	X	X
Python	Flask	✅	✅	X	X	X
Ruby	Rails	✅	✅	✅	✅	X
Ruby	Sinatra	✅	✅	✅	X	X
Php		✅	✅	✅	✅	X
Java	Spring	✅	✅	✅	X	X
Java	Jsp	✅	X	X	X	X
JS	Express	✅	✅	✅	X	X
JS	Next	X	X	X	X	X

Final Remarks

Although there is still room for improvement, I am committed to making steady progress. So, please keep your expectations high!